GPU VulnDB

Database/Control plane, storage & DevOps

AmdCpmDisplayFeatureSMM - SMM callout (AMD-SB-7027): An SMM callout in the AmdCpmDisplayFeatureSMM driver lets ring-0

CVSS 8.2CVE-2024-0179Control plane, storage & DevOpscurated

Impact

An SMM callout in the AmdCpmDisplayFeatureSMM driver lets ring-0 code overwrite SMRAM. SMM callouts are the classic UEFI escalation pattern: SMM code calls outward into memory the OS controls, so the OS supplies the code SMM then runs. Reported by Quarkslab, scored 8.2 with changed scope - the attacker crosses from the OS into the platform's most privileged context.

Who can reach it

Local, ring-0 on the host.

What to do

Fixed in AMD PI/AGESA firmware and delivered only as an OEM SBIOS package - AMD ships the PI drop to Dell, HPE, Supermicro, Lenovo and the ODMs, who each requalify before releasing BIOS. **Budget one to six months of OEM lag**, and note that several CVEs in this batch are marked 'no fix planned' on Naples (EPYC 7001) - for those the only remediation is retiring the hardware. Applying it means cordon, drain and a full power cycle per node; there is no driver reload, no live patch and no VBIOS step. Patch alongside the sibling AmdPspP2CmboxV2 issue in the same bulletin - they ship together and leaving one open leaves the class open.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-0179https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7027.html

Related entries

All Control plane, storage & DevOps entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.